Comment on "Decoy State Quantum Key Distribution 
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The main claim by H.K. Lo et al that they have for the first time made the decoy-state method 
efficiently work in practice is inappropriate. We show that, prior to our work, actually (and obvi- 
ously) none of proposals raised by H.K. Lo et al can really work in practice. Their main protocol 
requires infinite number of different coherent states which is in principle impossible for any set-up. 
Their idea of using very weak coherent state as decoy state doesn't work either by our detailed 
analysis. The idea implicitly requires an unreasonably large number of pulses which needs at least 
14 days to produce, if they want to do QKD over a distance of 120- 130km. 
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The recent paperQ, quant-ph/0411004 by H. K. Lo et 
al claims that they have for the first time made the decoy- 
state method efficiently useful in practice. The paperQ 
is an extended version of their earlier results announced 
in a number of conferences 0, Q We shall show that, 
actually, none of their proposal really works. 

Their main protocol requires infinite pulses. This 
fact has been emphasized by H.K. Lo in a number of 
conferences 0. Here are some statements quoted from 
Ref.0(page 27 or page 18): 

"Idea" 

"Try every Poisson distribution /i !" . "We propose that 
Alice switches power of her laser up and down, thus pro- 
ducing as decoy states Poisson photon number distribu- 
tions, f/s for all possible values of fi's." . In Lo's trans- 
parency, the words "every" and "all" are highlighted. 
The main protocol in their recent presentation^ is ob- 
viously the same with that in ref0. 

Actually, the main protocol given by Lo et alQ, is 
even worse than the Trivial idea of using single photon 
source. Trivial idea is more feasible than Lo's main pro- 
tocol: Although single photon source is difficult, it is at 
least in principle possible. However, producing infinite 
number of coherent states is in principle impossible. 

In RefQ, another idea by H. K. Lo is shortly 
stated: "On one hand, by using a vacuum as decoy state, 
Alice and Bob can verify the so called dark count rates of 
their detectors. On the other hand, by using a very weak 
coherent pulse as decoy state, Alice and Bob can easily 
lower bound the yield (channel transmittance) of single- 
photon pulses." We now show that this idea doesn't work 
either. By the idea, they need two sets of decoy pulses: 
Set Y contains M vacuum pulses |0)(0| and set Y v con- 
tains N pulses of very weak coherent state \fj, v )(fj, v | . They 
can only observe the total counts of set Y and the total 
counts of set Y v . By that idea0, to verify a meaningful 
lower bound of single photon yield, Si, the value /j, v must 
be less than channel transmittance n. For clarity, we 
assume zero dark count first. In the normal case when 
there is no Eve, N decoy pulses in class Y v will cause 
N(l — e~ w ") counts. For the security, one has no other 
choice but to assume the worst case that all multi-photon 
pulses have caused a count. Therefore the lower bound 



of single-photon counts is N[l — e~ 
fi v e-^-)} = N(nn v - 
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A*^/2). The lower bound value for 

"&;:-l /2) *V-»v/2. Therefore 
one has to request \x v < rj here if one wants to verify 
s i > 17/2. Now we consider the effect caused by dark 
counts. Suppose, after observed the counts of pulses in 
set Yq, they find that the dark count rate, sq = 10~ 6 for 
set Yq. Note that the dark count rate for set Yq and the 
dark count rate for set Y v can be a little bit different due 
to the statistical fluctuation. Given N pulses of state 
\Hv), there are Ae~ M " vacuum pulses and N(l — e _Ml ") 
non- vacuum pulses. Alice does not know which pulse 
is vacuum which pulse is non-vacuum. They can only 
observe the number of total counts (n t ) caused by N 
decoy pulses in set Y v , which is the summation of dark 
counts, no, the number of single-photon counts n\ and 
the number of multi- photon counts, n m , of those N de- 
coy pulses in set Y v . After observed the number of to- 
tal counts n t , they try to estimates n\ by the formula 
n t — no+ni+n m , with no = Ns' e~^ and the worst-case 



assumption of n m = N(l — e 
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'). The value 



s' is the dark count rate for set Y v and the value s' is 
never known exactly. They only know the approximate 
value, s w so = 10~ 6 . Consider the case 77 = 10~ 4 . (Re- 
mark: Here the device loss and detection loss are put to 
the channel, therefore 77 is the overall transmittance. The 
value 77 = 10 -4 corresponds to a distance of 120-130km.) 



The expected value of n\ 



is AT(1- 



') < 10-*N. 



Meanwhile, the expected number of dark counts is around 
10~ 6 N. Since the expected number of dark counts there 
is much larger than the expected number of n\ + n m , a 
little bit fluctuation of dark counts will totally destroy the 
estimation of the value n\ + n m therefore totally destroy 
the estimation of n\. To make a faithful estimation, we 
request the fluctuation of dark count to be much less than 
the expected value of ni+n m , 10 _8 A, e.g., in the magni- 
tude order of 10 _9 A. This is to say, one must make sure 
that the relative fluctuation of dark counts is less than 

0. 1%, with a probability exponentially close to 1 (say, 
1 — e~ 25 ). This requires N larger than 10 14 . In practice, 
the system repetition rate is normally less than 80M Hz, 

1. e., 8 x 10 7 /s. Producing 10 14 decoy pulses needs more 
than 14 days. 

In the end of their paper 0, they claim that they are 
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able to show their results with only a few states. This 
short statement there is rather vague and by far not a 
protocol. In particular, if they mean the idea in Ref.0], 
then it doesn't really work as we have shown. If they 
mean something else and their main claim is based on 
that, they should not use the phrase "for the first time" 
in their claim, since Ref 1] itself is presented latter than 
our work|5j. We also question their claim to do QKD over 
180km. They claimed so without showing any necessary 
details. They should at least clearly answer this 
question: What is the protocol and to make a 
statistically faithful estimation of lower bound of 
single photon yield, how many pulses are needed 
? We believe an unreasonably large number of pulses is 
needed and one needs more than one month to produce 
them, unless they actually use a new method, e.g., our 
methods reported in Ref|3, __\ in doing that estimation. 
Actually, so far they have never considered the constraint 
that the number of total pulses in practice can be only 
reasonably large. In their work, they have unconsciously 
assumed exact statistical estimation for small quantities. 

From the methodological viewpoint, in their main pro- 
tocol, they use the simple-minded method to solve the 
joint equations with infinite number of variables, i.e., the 
yields of each Fock states. We don't believe that they can 
really make the long distance QKD with only a few dif- 
ferent states by the simple-minded mathematical method 
used in their main protocol. From their start-point^Q, 
there are infinite variables. It is not surprising to solve 
the problem with infinite equations. But the job is non- 
trivial if there are only a few equations. Therefore, the 
authors of RefpJ should clearly state the protocol rather 
than vaguely claim that they can make it with a few de- 
coy states in Ref0. However, it is possible for anyone 
to make it with only a few decoy states by a non-trivial 
mathematical method, e.g., the method in our workp|. 
In our workQ, we have put all multi-photon counts into 
one mixed state, p c , therefore, we only need to consider 
three variables, the yields of states |0)(0|, |1)(1| and p c 
with non-trivial inequalities. We have chosen reason- 
able values for both u and u' in using our method 5] . If 
we don't mind decreasing the key rate, we can also choose 
a very small value for one of them. But such a setting is 
unnecessary since it's key rate is always lower than the 
those normal settings. We remind other authors not to 
regard a poorly set special case of our method as their 
own protocol. 

We have shown that, prior to our work 5], none of 
decoy-state protocol^ or ideaQ by H. K. Lo et al re- 
ally works efficiently in practice. Actually, so far our re- 
sult presented in |quant-ph704 10075|i| is the unique pro- 
tocol that works efficiently in practice, by decoy-state 
method. If, in RefpJ, their main claim is actually based 
on something different from their previously announced 
results|2j, |3| , since RefQ itself is presented later than our 
workp|, then at least the phrase "for the first time" is 
inappropriate in their claim. 

In conclusion, the main claim by H.K. Lo et aljj is in- 



appropriate. Their main protocol requires infinite num- 
ber of pulses and their methodology in the main pro- 
tocol is to straightforwardly solve joint equations with 
infinite variables. Their idea in Ref0 doesn't work ei- 
ther because it implicitly requires at least 14 days to 
complete one protocol. If the authors of Reffl) in- 
sist on their main claim, it should not be difficult 
for them to answer these simple questions: Prior 
to our work[5], which of their protocol can really 
work in practice ? If they had one, what is it and 
where is it ? How many pulses does it need ? We 
believe that actually, so far our result 5] is the unique 
clearly stated protocol that works efficiently in practice, 
by decoy-state method. Our method is further developed 
in RefQ. Besides our protocol^, if anybody happens 
to know another clearly stated decoy-state protocol that 
works efficiently in practice, please let me know, (email: 
wang_xiangbin@hotmail.com; wang@qci.jst.go.jp) 

Note Added: More than one month after this comment 
was presented, a separate article on decoy-state proto- 
col was presented 0. We emphasize that the protocol as 
stated in Ref@], with using the main ideas of our workp|, 
is different from Lo's earlier idea stated in Ref§. Their 
new separate work|(j does not change the fact that prior 
to our work 5] , no decoy-state method can really work 
efficiently in practice. 

The idea stated in|3( only suggests watching the count- 
ing rates of decoy states of vacuum and very weak coher- 
ent states and calculating the lower bound of single pho- 
ton counts with these. As we have shown, in this way, the 
decoy coherent state must be very weak: Its average pho- 
ton number must be less than the channel transmittancc 
n therefore the protocol|3| doesn't work due to the sta- 
tistical fluctuation of dark count. However, the method 
in@] suggests watching the counting rates of both decoy 
states and signal states and treating them jointly with 
non-trivial inequalities. This is indeed the main idea of 
our method |3| . In such a way, the intensity of the decoy 
coherent state need not to be very weak. 

The difference between their "Vacuum + Weak decoy 
coherent state" protocol^ and our protocol^ is mainly 
in the specific parameter settings. We have chosen u,fi' 
in the range of 0.2-0.45 only because we believe this range 
gives good results. Our formula for calculation of A also 
works for the specific parameter setting used in their 
work|6(. Definitely we can also use the stronger GLLP 
formula as recommended in Ref[6j for our protocol. Here 
we suggest using the strongest GLLP formula given very 
recently 7] for key distillation of our protocols 0, 0. In 
my opinion, their result looks more like comparison of dif- 
ferent GLLP formulas rather than different decoy-state 
protocols. 

Our protocol was then improved 4] . We believe that 
the key rate of the protocol in Ref 4] is quite good even 
compared with their new workjfj, using the same GLLP 
formula for key distillation. 
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